fix(webapp): support cloudflare api domain + wildcard cors

CHANGELOG.md

@@ -16,6 +16,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Backend CORS now accepts configured origins plus `*.lucassantana.tech` and `*.luk-homeserver.com.br` hosts for dashboard/API split-domain setups
+- Frontend API client now auto-resolves hosted API base to `api.lucassantana.tech` or `api.luk-homeserver.com.br` when `VITE_API_BASE_URL` is not set
 - Vercel routing no longer rewrites `/api/*` back to the same Lucky host, preventing `508 INFINITE_LOOP` on OAuth login
 - Frontend API base URL now supports `VITE_API_BASE_URL` for hosted deployments that use a separate backend origin
 - Deploy webhook trigger now uses strict curl connect/request timeouts to avoid long hangs in CI deploy jobs

README.md

@@ -130,6 +130,8 @@ Triggers the GitHub `Deploy to Homelab` workflow, waits for completion, and show
 Vercel note: `vercel.json` runs `npm run db:generate` before `build:shared` and `build:frontend` to ensure Prisma generated client files are present during cloud builds.
 For hosted frontend deployments, set `VITE_API_BASE_URL` to your backend API origin
 (example: `https://api.yourdomain.com/api`) to avoid auth/API loop misrouting.
+Without `VITE_API_BASE_URL`, frontend now auto-targets `api.lucassantana.tech` for
+`*.lucassantana.tech` hosts and `api.luk-homeserver.com.br` for `*.luk-homeserver.com.br`.
 
 ## Environment Variables
 

docs/WEBAPP_SETUP.md

@@ -75,6 +75,8 @@ For hosted frontend builds (Vercel/Netlify), set frontend env:
 VITE_API_BASE_URL=https://api.yourdomain.com/api
 ```
 
+`WEBAPP_FRONTEND_URL` also supports comma-separated origins for CORS
+(for example `https://lucky.lucassantana.tech,https://app.lucassantana.tech`).
 ### Environment Variable Descriptions
 
 - **CLIENT_ID**: Your Discord application's Client ID from the [Discord Developer Portal](https://discord.com/developers/applications)

packages/backend/src/middleware/index.ts

@@ -12,10 +12,45 @@
 export function setupMiddleware(app: Express): void {
     const frontendUrl =
         process.env.WEBAPP_FRONTEND_URL ?? 'http://localhost:5173'
+    const configuredOrigins = frontendUrl
+        .split(',')
+        .map((origin) => origin.trim())
+        .filter((origin) => origin.length > 0)
+
+    const isAllowedOrigin = (origin: string): boolean => {
+        if (configuredOrigins.includes(origin)) {
+            return true
+        }
+
+        try {
+            const parsed = new URL(origin)
+            const host = parsed.hostname.toLowerCase()
+
+            if (host === 'localhost' || host === '127.0.0.1') {
+                return true
+            }
+
+            return (
+                host === 'lucassantana.tech' ||
+                host.endsWith('.lucassantana.tech') ||
+                host === 'luk-homeserver.com.br' ||
+                host.endsWith('.luk-homeserver.com.br')
+            )
+        } catch {
+            return false
+        }
+    }
 
     app.use(
         cors({
-            origin: frontendUrl,
+            origin: (origin, callback) => {
+                if (!origin || isAllowedOrigin(origin)) {
+                    callback(null, true)
+                    return
+                }
+
+                callback(new Error('Not allowed by CORS'))
+            },
             credentials: true,
             methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
             allowedHeaders: ['Content-Type', 'Authorization'],

packages/frontend/src/services/api.ts

@@ -16,10 +16,35 @@
 import { createLogsApi } from './logsApi'
 
 const configuredApiBase = import.meta.env.VITE_API_BASE_URL?.trim()
-const API_BASE = (configuredApiBase && configuredApiBase.length > 0
-    ? configuredApiBase
-    : '/api'
-).replace(/\/+$/, '')
+
+const inferApiBase = (): string => {
+    if (configuredApiBase && configuredApiBase.length > 0) {
+        return configuredApiBase
+    }
+
+    if (typeof window !== 'undefined') {
+        const protocol = window.location.protocol || 'https:'
+        const hostname = window.location.hostname
+
+        if (
+            hostname === 'lucassantana.tech' ||
+            hostname.endsWith('.lucassantana.tech')
+        ) {
+            return `${protocol}//api.lucassantana.tech/api`
+        }
+
+        if (
+            hostname === 'luk-homeserver.com.br' ||
+            hostname.endsWith('.luk-homeserver.com.br')
+        ) {
+            return `${protocol}//api.luk-homeserver.com.br/api`
+        }
+    }
+
+    return '/api'
+}
+
+const API_BASE = inferApiBase().replace(/\/+$/, '')
 
 interface BackendGuild {
     id: string